CVE-2016-4997 The compat IPT_SO_SET_REPLACE and IP6T_SO_SET_REPLACE setsockopt implementations in the netfilter subsystem in the Linux kernel before 4.6.3 allow local users to gain privileges or cause a denial of s...
HighCVSS 7.8
EPSS 5.7%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
The compat IPT_SO_SET_REPLACE and IP6T_SO_SET_REPLACE setsockopt implementations in the netfilter subsystem in the Linux kernel before 4.6.3 allow local users to gain privileges or cause a denial of service (memory corruption) by leveraging in-container root access to provide a crafted offset value that triggers an unintended decrement.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/linux(Debian:12) | < 4.6.2-2 | 4.6.2-2 |
| debian/linux(Debian:13) | < 4.6.2-2 | 4.6.2-2 |
| debian/linux(Debian:14) | < 4.6.2-2 | 4.6.2-2 |
| Linux kernel | >= 2.6.17, < 3.2.80 | 3.2.80 |
| Linux kernel | >= 3.3, < 3.10.103 | 3.10.103 |
| Linux kernel | >= 3.11, < 3.12.62 | 3.12.62 |
| Linux kernel | >= 3.13, < 3.14.73 | 3.14.73 |
| Linux kernel | >= 3.15, < 3.16.37 | 3.16.37 |
| Linux kernel | >= 3.17, < 3.18.37 | 3.18.37 |
| Linux kernel | >= 3.19, < 4.1.28 | 4.1.28 |
| Linux kernel | >= 4.2, < 4.4.14 | 4.4.14 |
| Linux kernel | >= 4.5, < 4.6.3 | 4.6.3 |
| Canonical Ubuntu Linux | = 12.04 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 15.10 | No fix listed |
| Canonical Ubuntu Linux | = 16.04 | No fix listed |
| novell suse linux enterprise software development kit | = 12.0 | No fix listed |
| novell suse linux enterprise software development kit | = 12.0-sp1 | No fix listed |
| novell suse linux enterprise desktop | = 12.0 | No fix listed |
| novell suse linux enterprise desktop | = 12.0-sp1 | No fix listed |
| novell suse linux enterprise live patching | = 12.0 | No fix listed |
| novell suse linux enterprise module for public cloud | = 12.0 | No fix listed |
| novell suse linux enterprise real time extension | = 12.0-sp1 | No fix listed |
| novell suse linux enterprise server | = 12.0 | No fix listed |
| novell suse linux enterprise server | = 12.0-sp1 | No fix listed |
Show 4 more
| Product | Affected versions | Fixed in |
|---|---|---|
| novell suse linux enterprise workstation extension | = 12.0 | No fix listed |
| novell suse linux enterprise workstation extension | = 12.0-sp1 | No fix listed |
| oracle linux | = 7 | No fix listed |
| debian linux | = 8.0 | No fix listed |
References
- Debian Security Tracker CVE-2016-4997 vendor-advisory
- git.kernel.org vendor-advisory
- SUSE-SU-2016:1709 third-party-advisory vendor-advisory
- SUSE-SU-2016:1710 third-party-advisory vendor-advisory
- SUSE-SU-2016:1937 third-party-advisory vendor-advisory
- SUSE-SU-2016:1985 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2016:2018 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2016:2105 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2016:2174 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2016:2177 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2016:2178 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2016:2179 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2016:2180 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2016:2181 mailing-list third-party-advisory vendor-advisory
- openSUSE-SU-2016:2184 mailing-list third-party-advisory vendor-advisory
- RHSA-2016:1847 third-party-advisory vendor-advisory
- RHSA-2016:1875 third-party-advisory vendor-advisory
- RHSA-2016:1883 third-party-advisory vendor-advisory
- DSA-3607 third-party-advisory vendor-advisory
- www.kernel.org vendor-advisory
- [oss-security] 20160624 Linux CVE-2016-4997 (local privilege escalation) and CVE-2016-4998 (out of bounds memory access) mailing-list third-party-advisory
- [oss-security] 20160929 CVE request - Linux kernel through 4.6.2 allows escalade privileges via IP6T_SO_SET_REPLACE compat setsockopt call exploit mailing-list third-party-advisory
- www.oracle.com third-party-advisory
- www.oracle.com third-party-advisory
- www.oracle.com third-party-advisory
- 91451 third-party-advisory vdb-entry
- 1036171 third-party-advisory vdb-entry
- USN-3016-1 third-party-advisory vendor-advisory
- USN-3016-2 third-party-advisory vendor-advisory
- USN-3016-3 third-party-advisory vendor-advisory
- USN-3016-4 third-party-advisory vendor-advisory
- USN-3017-1 third-party-advisory vendor-advisory
- USN-3017-2 third-party-advisory vendor-advisory
- USN-3017-3 third-party-advisory vendor-advisory
- USN-3018-1 third-party-advisory vendor-advisory
- USN-3018-2 third-party-advisory vendor-advisory
- USN-3019-1 third-party-advisory vendor-advisory
- USN-3020-1 third-party-advisory vendor-advisory
- bugzilla.redhat.com issue-tracking third-party-advisory
- github.com exploit third-party-advisory
- github.com patch third-party-advisory
- h20566.www2.hpe.com third-party-advisory
- 40435 exploit third-party-advisory vdb-entry
- 40489 exploit third-party-advisory vdb-entry